Adversary Emulation Fundamentals GASAE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An adversary emulation engagement has concluded. The team identified that the SOC missed a series of techniques that ultimately led to simulated domain administrator compromise. What is the most effective way to present the findings to drive improvement?

   • AList only the final outcome and recommend purchasing a new SIEM platform.
   • BPublish the report only to executive leadership to avoid embarrassing the SOC.
   • CProvide a detailed timeline of the emulated attack, mapping each step to MITRE ATT&CK techniques and highlighting where detections failed.
   • DShare the raw logs with the SOC and let them analyze the gaps themselves.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   After an adversary emulation, the security team finds that a critical detection rule did not fire during the emulation. The rule is known to have a high false-positive rate, and the team had previously tuned it to be less sensitive. The team is now unsure whether the rule missed the attack because of the tuning or because of a flaw in the rule. What is the best next step?

   • AReview the rule's logic and the emulation logs to determine why it did not fire, then adjust the rule and re-run the emulation step.
   • BDisable the rule because it is not reliable and rely on other rules for detection.
   • CAssume the rule is flawed and create a new rule from scratch without further investigation.
   • DImmediately revert the rule to its original, more sensitive version to ensure future detections.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is planning an adversary emulation engagement. They have a limited budget and a short timeline. The team wants to focus on the most critical risks to the organization. Which scoping decision is most appropriate?

   • AEmulate only the techniques that the security team is already confident they can detect.
   • BEmulate only the techniques that are easiest to execute to save time and money.
   • CEmulate all techniques from the MITRE ATT&CK framework to ensure complete coverage.
   • DFocus on the techniques that are most relevant to the organization's threat model and that have the highest potential impact.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A threat intelligence report describes an adversary that uses a specific command-line tool for discovery. The tool is not commonly used in the organization's environment, and the security team is concerned that emulating it might trigger false positives in their SIEM. The team wants to validate detection without causing alert fatigue. What is the best approach?

   • ASkip the technique because it is likely to cause false positives.
   • BEmulate the technique using the exact tool, and then tune the SIEM rules to reduce false positives while maintaining detection.
   • CUse a different tool that is more common in the environment to avoid false positives.
   • DEmulate the technique but do not check the SIEM alerts to avoid dealing with false positives.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An emulation team is executing a technique that involves using a legitimate administrative tool to perform discovery. The tool is also used by the organization's IT team for routine maintenance. The team is concerned that the emulation might be mistaken for legitimate activity and not trigger any alerts. What is the best approach to ensure the emulation is effective?

   • ARun the technique as-is and then review the SIEM logs to see if the activity was detected or if it blended in with legitimate traffic.
   • BSkip the technique because it is too similar to legitimate activity to be detected.
   • CModify the tool's behavior to make it more detectable, such as using unusual command-line arguments.
   • DUse a different tool that is not used by the IT team to avoid confusion.
   Reveal Solution Discussion Select an answer first